.envĀ files were fine until migrations, rotations, Kubernetes, OIDC, and app sprawl turned them into a liability.
June
At small scale,Ā .envĀ files felt good enough. Then the environment grew. Apps moved hosts. Docker gave way to k3s. OIDC secrets regenerated. Databases stayed external. App configs needed to be restored, moved, and updated.
.envĀ filesSuddenly, secrets were not just āconfiguration.ā They were scattered operational risk.
Infisical became part of the platform foundation before the k3s app migration. Secrets could be stored centrally and delivered into Kubernetes through the operator instead of recreating the sameĀ .envĀ sprawl in a new format.
A secret copied everywhere is not really a secret.
paste commands hereThe migration was not just putting apps into pods. It was separating application workloads from the core infrastructure those workloads depend on.
June
The lab moved from scattered Docker hosts toward a k3s-based application platform. Kaveh and Thoma stopped being the center of the app world. Workloads moved into Kubernetes. The platform started to look more intentional.
But the important decision was what did not move into k3s.
DNS stayed in LXCs. PostgreSQL and MariaDB stayed external. Storage stayed on Zhongli. Backups stayed separate. Pangolin/Newt continued handling public access. Infisical handled secrets. Traefik handled internalĀ .fndhomeĀ ingress. That separation kept the cluster from depending on itself for the things it needs to survive.
Kubernetes was not the boss fight. Storage, secrets, databases, ingress, and rollback were the boss fight.
paste commands here